Description
The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information.
References
- 1017535 vdb-entry
- 22111 vdb-entry
- 32720 vdb-entry
- ADV-2007-0245 vdb-entry
- 1017536 vdb-entry
- 23836 third-party-advisory
- cisco-csmars-asdm-device-spoofing(31567) vdb-entry
- 20070118 SSL/TLS Certificate and SSH Public Key Validation Vulnerability vendor-advisory